@amaster.ai/employee-runtime-connector 0.1.1-beta.217 → 0.1.1-beta.219

package/README.md

@@ -54,6 +54,8 @@ Runtime code belongs in the container image. Persist only connector state, the r
 
 The Server requires `final_model_context_attestation_v1` for governed Pi runs because that path disables ambient context discovery and injects a run-owned compiled instruction bundle. This is a Pi delivery contract, not a connector-wide requirement: an explicitly selected self-hosted Codex runtime continues through its own Runtime Actions V2 and native-session contracts and cannot borrow the Pi attestation claim. Adding the same final-context guarantee to another executor requires executor-specific proof for scoped project-instruction semantics, the normalized final active tool schemas, the selected model's context window, automatically visible skill metadata, and resumed-session history.
 
+For Server-dispatched Codex `run` and `wakeup` commands, the effective model comes from the command's `mirrorxRuntimeConnectorTaskSessionV1.configuredModel` snapshot and is passed to Codex with `--model`. `AMASTER_CODEX_MODEL` is only a compatibility fallback for older commands that do not contain that snapshot; it does not override a Server-issued model or an explicit Server-issued `null` model. A malformed or identity-mismatched snapshot fails closed with `codex_model_authority_invalid`. Its non-empty `taskKey` is an opaque Server task-session identity and is not required to equal the Issue id; the current adapter binding intentionally accepts only `codex_local`.
+
 For admitted Pi runs, the daemon compiles source-repository `AGENTS.md` and `AGENTS.override.md` topology into one root `AGENTS.md` with explicit relative scopes, same-scope override semantics, and a higher-authority MirrorX platform block. Governed Pi preserves operator-configured user extensions and tools, disables ambient skill and context-file discovery, and injects that exact compiled file through a run-owned final-system-prompt extension. `pi-mcp-adapter` normally merges the operator's user-level `mcp.json` with the run-owned workspace `.pi/mcp.json`; the workspace definition wins on a same-name server, and only environment placeholders referenced by preserved user MCP definitions are granted to the child. Governed MCP tools remain fail-closed: the daemon requires their exact catalog and schemas while accepting additional Pi-native or user-extension tools, including the adapter proxy when a user MCP needs it. Run-exit closure applies the same rule to its two required MirrorX tools as a schema-bound subset instead of rejecting the ambient user tool surface. When the operator-owned Pi settings declare `@amaster.ai/pi-telemetry`, the daemon verifies that package's immutable identity and preserves the authoritative runtime run id for trace correlation while Pi loads it normally from the shared settings. A last-ordered `before_provider_request` hook then validates every provider call, including later calls after tool results: exactly one system message contains the compiled instructions, visible role-skill metadata and the attested active tool contract match their prior attestations, and the complete serialized input fits the context window. It does not override the active model's output limit or inject provider `max_tokens`, `max_completion_tokens`, or `max_output_tokens`; no `modelMaxOutputTokens` substitute exists. Each call appends metadata-only hashes and sizes to a bounded chained receipt; a missing, broken, or oversized chain fails the run.
 
 Pi 0.80.10's internal compaction summarizer calls the provider outside `before_provider_request`. The Enabled profile therefore records and cancels every `session_before_compact` attempt and fails immediately if `session_compact` is nevertheless observed. No model-generated compaction summary is accepted until that provider path has equivalent final-context attestation. The Server also enumerates Pi and Codex as the only supported governed executors at configuration and heartbeat dispatch boundaries; missing or unknown executor kinds fail closed.